Password protect a PDF
Encrypt a PDF with AES-256 so it cannot be opened without the password — and neither the file nor the password is ever stored, which is the only way a password tool should work.
- Never stored
- No queue, no waiting
- No signup, no watermark
How it works
Add your PDF
Drop the document you want to lock.
Choose a password
Type it twice. Optionally decide whether printing, copying and editing are allowed.
Download
Your encrypted PDF asks for the password in every reader, on every device.
What encrypting does to the file
Encryption in a PDF is applied to each string and each stream separately, which means every one of them has to be individually reachable first. So the document is written out with its object streams and cross-reference stream expanded back into plain numbered objects and a classic index, and only then encrypted piece by piece. That is why a protected file usually comes out slightly larger than the one you started with: the structure is no longer packed into compressed streams, strings become hex ciphertext, and every encrypted piece carries a 16-byte initialisation vector.
What is inside is preserved as it was — pages, the bookmark outline, form fields and their values, attachments and tags are wrapped rather than rewritten. One thing does not come through: the document information dictionary. Title, author, subject and the creation date are not carried into the rebuilt file, so a reader shows the locked document with those fields empty. The XMP metadata stream, which a good deal of software reads instead, is kept and encrypted along with the content.
The encryption written here is the newest the format defines, and that costs something at the other end. Readers built before about 2011 — Acrobat 9 and earlier, some e-book readers, the viewers built into scanners and multifunction printers — cannot open an AES-256 file at all, and report it as damaged or unsupported rather than asking for a password.
When you want something else
A PDF password controls who can open the file and nothing after that. Whoever opens it can save an unprotected copy in seconds, so this protects a document in transit and on a shared drive, not from the people you send it to. If the requirement is that only one named recipient can ever read the contents, encrypt the container instead — a 7-Zip archive with AES, or age or GPG against their key — and send the password by a different route from the file.
For a batch, or for a recipient on old software, qpdf does the same job from a script and lets you choose the older standard: qpdf --encrypt --user-password=... --owner-password=... --bits=128 --use-aes=y -- in.pdf out.pdf writes AES-128, which readers going back to the mid-2000s can open.
Frequently asked questions
How strong is the encryption?
AES-256 with revision 6 key derivation — the strongest the PDF format defines, and the same standard Acrobat uses. The password is put through a deliberately slow hash designed so that graphics cards cannot speed up guessing it.
Is my file or password stored anywhere?
Neither, and this is the tool where that matters most. Nothing is stored, so your document and the password that protects it are never both in someone else's hands. A site that encrypts on its server has, by definition, seen both.
What if I forget the password?
The file is gone. There is no recovery, no back door and no master key — that is what makes the encryption worth anything. Write the password down somewhere safe before you send the file.
What do the permission settings actually do?
They tell reader software what to allow — printing, copying text, editing. Be clear-eyed about them: they are requests, not encryption, and any determined person can ignore them. The open-password is the part that genuinely protects the document.
Will it open on a phone, in Acrobat, in Chrome?
Yes. It is standard PDF encryption, so every modern reader on every platform will prompt for the password and open it.
Can I protect a PDF that is already protected?
Remove the existing password first with Unlock PDF, then protect it again with the new one.
Good to know: A password is only as good as its strength: a short or common one can be guessed offline by anyone who has the file. Use something long. Permission settings (print, copy, edit) are advisory and honoured only by well-behaved readers.
Put this tool on your website
Free for any blog, class page or help article. Paste one snippet and your visitors can use it right on your page.